The mirroring of network traffic is a common feature found in many network relay devices, such as network switches. Network traffic mirroring, or port mirroring, is a method of monitoring network traffic that forwards a copy of incoming and outgoing traffic from one port of a network device, such as a switch, to another port of the network device from which the mirrored network traffic may be studied. Network traffic mirroring provides a service that duplicates network traffic as it passes through a device to another port, or remote system, and may duplicates all or a portion of the network traffic. Network traffic mirroring may be used for network troubleshooting, network security and performance monitoring, and security audits. A network administrator may use mirroring as a diagnostic tool or debugging feature, such as a tool for investigating network intrusions or network attacks. Network mirroring may be performed and managed locally or remotely.
Current techniques for mirroring data are limited in that they static. The traffic mirroring has to be manually established and configured. In a system where multiple flows of traffic are to be monitored, multiple traffic mirroring must be set-up and configured. Each instance of traffic mirroring requires bandwidth and as the number of traffic mirrors increases the load on the network increases. This is inefficient because in some instances a network operator may only want to have certain traffic mirrored or to mirror traffic only if certain criterion is met. For example, in performing a wire tap of a Voice over IP network (VoIP) communication, law enforcement organizations may only be interested in communications between certain end users. Likewise a network operator may only wish to mirror traffic if bandwidth of a network communication increases above a certain amount.
Therefore what is need is a method and system for dynamically mirroring traffic that does not need to be manually established and configured. In this manner additional traffic mirrors can be established as needed to mirror specific traffic or in response to certain criteria.